@dotenvx/dotenvx 1.69.1 → 1.70.0

package/CHANGELOG.md

@@ -2,7 +2,19 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.69.1...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.70.0...main)
+
+## [1.70.0](https://github.com/dotenvx/dotenvx/compare/v1.69.2...v1.70.0) (2026-05-31)
+
+### Changed
+
+* Dotenvx Ops/Vlt is now Dotenvx Armor ⛨ ([#830](https://github.com/dotenvx/dotenvx/pull/830))
+
+## [1.69.2](https://github.com/dotenvx/dotenvx/compare/v1.69.1...v1.69.2) (2026-05-29)
+
+### Changed
+
+* Minor messaging improvements, especially if using armored keys ([#825](https://github.com/dotenvx/dotenvx/pull/825))
 
 ## [1.69.1](https://github.com/dotenvx/dotenvx/compare/v1.69.0...v1.69.1) (2026-05-25)
 

package/README.md

@@ -1,4 +1,4 @@
-[![dotenvx](https://dotenvx.com/banner.png)](https://dotenvx.com)
+[![dotenvx](https://dotenvx.com/banner.png?v2)](https://dotenvx.com)
 
 *a secure dotenv*–from the creator of [`dotenv`](https://github.com/motdotla/dotenv).
 
@@ -1287,14 +1287,16 @@ $ dotenvx run -fk .env.keys -f apps/app1/.env -- yourcommand
 ```
 
 </details>
-<details><summary>`run --no-vlt`</summary><br>
+<details><summary>`run --no-armor`</summary><br>
 
-Turn off [Dotenvx Vlt Ops](https://dotenvx.com/vlt) features.
+Turn off [Dotenvx Armor ⛨](https://dotenvx.com/armor) features.
 
 ```sh
-$ dotenvx run --no-vlt -- yourcommand
+$ dotenvx run --no-armor -- yourcommand
 ```
 
+`--no-vlt` and `--no-ops` are deprecated aliases.
+
 </details>
 <details><summary>`get KEY`</summary><br>
 
@@ -1622,15 +1624,17 @@ $ dotenvx encrypt -f .env.production
 ```
 
 </details>
-<details><summary>`encrypt --no-vlt`</summary><br>
+<details><summary>`encrypt --no-armor`</summary><br>
 
-Turn off [Dotenvx Vlt Ops](https://dotenvx.com/vlt) features for encrypt.
+Turn off [Dotenvx Armor ⛨](https://dotenvx.com/armor) features for encrypt.
 
 ```sh
-$ dotenvx encrypt --no-vlt
+$ dotenvx encrypt --no-armor
 ◈ encrypted (.env)
 ```
 
+`--no-vlt` and `--no-ops` are deprecated aliases.
+
 </details>
 <details><summary>`encrypt -fk`</summary><br>
 
@@ -2548,15 +2552,17 @@ $ dotenvx run --convention=nextjs -- node index.js
 ```
 
 </details>
-<details><summary>`config(noVlt:)` - noVlt</summary><br>
+<details><summary>`config(noArmor:)` - noArmor</summary><br>
 
-Turn off [Dotenvx Vlt Ops](https://dotenvx.com/vlt) features.
+Turn off [Dotenvx Armor ⛨](https://dotenvx.com/armor) features.
 
 ```js
 // index.js
-require('@dotenvx/dotenvx').config({noVlt: true})
+require('@dotenvx/dotenvx').config({noArmor: true})
 ```
 
+`noVlt` and `noOps` are deprecated aliases.
+
 </details>
 <details><summary>`parse(src)`</summary><br>
 
@@ -2650,17 +2656,17 @@ This is known as *Decryption at Access* and is written about in [the whitepaper]
 
 &nbsp;
 
-## Vlt Ops ⛨
+## Armor ⛨
 
-[![dotenvx-vlt](https://dotenvx.com/dotenvx-vlt-banner.png)](https://dotenvx.com/vlt)
+[![dotenvx-armor](https://dotenvx.com/dotenvx-armor-banner.png?v2)](https://dotenvx.com/armor)
 
 ```
 ⛨ ARMORED KEYS: Harden your private keys.
-⮕ install [curl -sfS https://dotenvx.sh/vlt | sh]
-⮕ then run [dotenvx-vlt login]
+⮕ install [curl -sfS https://dotenvx.sh/armor | sh]
+⮕ then run [dotenvx armor login]
 ```
 
-[Learn more](https://dotenvx.com/vlt)
+[Learn more](https://dotenvx.com/armor)
 
 &nbsp;
 

package/package.json

@@ -1,7 +1,7 @@
 {
-  "version": "1.69.1",
+  "version": "1.70.0",
   "name": "@dotenvx/dotenvx",
-  "description": "secrets for agents–from the creator of `dotenv`",
+  "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",
   "keywords": [
     "dotenv",
@@ -35,11 +35,12 @@
   "scripts": {
     "standard": "standard",
     "standard:fix": "standard --fix",
-    "test": "tap run --test-env=DOTENVX_NO_VLT=true --allow-empty-coverage --disable-coverage --timeout=60000",
-    "test-coverage": "tap run --test-env=DOTENVX_NO_VLT=true --show-full-coverage --timeout=60000",
+    "test": "tap run --test-env=DOTENVX_NO_ARMOR=true --allow-empty-coverage --disable-coverage --timeout=60000",
+    "test-coverage": "tap run --test-env=DOTENVX_NO_ARMOR=true --show-full-coverage --timeout=60000",
     "testshell": "bash shellspec",
-    "prerelease": "npm test && npm run testshell",
-    "release": "standard-version"
+    "release:check": "npm test && npm run testshell",
+    "prerelease": "npm run release:check",
+    "release": "npm run release:check && standard-version"
   },
   "funding": "https://dotenvx.com",
   "dependencies": {

package/src/cli/actions/decrypt.js

@@ -5,17 +5,17 @@ const Decrypt = require('./../../lib/services/decrypt')
 const catchAndLog = require('../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
-const normalizeVltOptions = require('./normalizeVltOptions')
+const normalizeArmorOptions = require('./normalizeArmorOptions')
 
 async function decrypt () {
-  const options = normalizeVltOptions(this.opts())
+  const options = normalizeArmorOptions(this.opts())
   const spinner = await createSpinner({ ...options, text: 'decrypting' })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
   const sesh = new Session()
   const envs = this.envs
-  const noVlt = options.vlt === false || (await sesh.noVlt())
+  const noArmor = options.armor === false || (await sesh.noArmor())
 
   let errorCount = 0
 
@@ -23,7 +23,7 @@ async function decrypt () {
   if (options.stdout) {
     const {
       processedEnvs
-    } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noVlt).run()
+    } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       if (processedEnv.error) {
@@ -45,7 +45,7 @@ async function decrypt () {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noVlt).run()
+      } = await new Decrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`decrypting ${processedEnv.envFilepath} (${processedEnv.filepath})`)
@@ -63,8 +63,10 @@ async function decrypt () {
       }
 
       if (spinner) spinner.stop()
+      const armoredPrivateKeyUsed = processedEnvs.some((processedEnv) => processedEnv.armoredPrivateKeyUsed)
+      const keyUsedSuffix = armoredPrivateKeyUsed ? ' · armored ⛨' : ''
       if (changedFilepaths.length > 0) {
-        logger.success(`◇ decrypted (${changedFilepaths.join(',')})`)
+        logger.success(`◇ decrypted (${changedFilepaths.join(',')})${keyUsedSuffix}`)
       } else if (unchangedFilepaths.length > 0) {
         logger.info(`○ no change (${unchangedFilepaths})`)
       } else {

package/src/cli/actions/encrypt.js

@@ -4,26 +4,25 @@ const { logger } = require('./../../shared/logger')
 const Encrypt = require('./../../lib/services/encrypt')
 
 const catchAndLog = require('../../lib/helpers/catchAndLog')
-const localDisplayPath = require('../../lib/helpers/localDisplayPath')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const prompts = require('../../lib/helpers/prompts')
 const Session = require('../../db/session')
-const normalizeVltOptions = require('./normalizeVltOptions')
+const normalizeArmorOptions = require('./normalizeArmorOptions')
 
 function keypairSpinnerHooks (spinner) {
-  let stoppedForVlt = false
+  let stoppedForArmor = false
 
   return {
     onStderr: () => {
-      if (spinner && !stoppedForVlt) {
+      if (spinner && !stoppedForArmor) {
         spinner.stop()
-        stoppedForVlt = true
+        stoppedForArmor = true
       }
     },
     after: () => {
-      if (spinner && stoppedForVlt) {
+      if (spinner && stoppedForArmor) {
         spinner.start('encrypting')
-        stoppedForVlt = false
+        stoppedForArmor = false
       }
     }
   }
@@ -37,10 +36,10 @@ function keyStorageSelector (spinner) {
 
     if (spinner) spinner.stop()
     selected = await prompts.select({
-      message: 'Select key storage',
+      message: 'Choose private key storage',
       choices: [
-        { name: 'Local (.env.keys)', value: 'local' },
-        { name: 'Armored ⛨', value: 'armored' }
+        { name: '◫ File (.env.keys)', value: 'file' },
+        { name: '⛨ Armor (armor.dotenvx.com)', value: 'armored' }
       ]
     }, {
       input: process.stdin,
@@ -52,12 +51,12 @@ function keyStorageSelector (spinner) {
   }
 }
 
-function encryptOptions (spinner, noVlt) {
+function encryptOptions (spinner, noArmor) {
   const options = {
     keypairHooks: keypairSpinnerHooks(spinner)
   }
 
-  if (!noVlt) {
+  if (!noArmor) {
     options.selectKeyStorage = keyStorageSelector(spinner)
   }
 
@@ -65,21 +64,21 @@ function encryptOptions (spinner, noVlt) {
 }
 
 async function encrypt () {
-  const options = normalizeVltOptions(this.opts())
+  const options = normalizeArmorOptions(this.opts())
   const spinner = await createSpinner({ ...options, text: 'encrypting' })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
   const sesh = new Session()
   const envs = this.envs
-  const noVlt = options.vlt === false || (!options.token && (await sesh.noVlt()))
+  const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
   const noCreate = options.create === false
 
   // stdout - should not have a try so that exit codes can surface to stdout
   if (options.stdout) {
     const {
       processedEnvs
-    } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noVlt, noCreate, options.token, encryptOptions(spinner, noVlt)).run()
+    } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, encryptOptions(spinner, noArmor)).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       console.log(processedEnv.envSrc)
@@ -91,7 +90,7 @@ async function encrypt () {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noVlt, noCreate, options.token, encryptOptions(spinner, noVlt)).run()
+      } = await new Encrypt(envs, options.key, options.excludeKey, options.envKeysFile, noArmor, noCreate, options.token, encryptOptions(spinner, noArmor)).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`encrypting ${processedEnv.envFilepath} (${processedEnv.filepath})`)
@@ -108,15 +107,10 @@ async function encrypt () {
 
       if (spinner) spinner.stop()
       if (changedFilepaths.length > 0) {
-        const localKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.localPrivateKeyAdded)
         const remoteKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.remotePrivateKeyAdded)
         let msg = `◈ encrypted (${changedFilepaths.join(',')})`
-        if (localKeyAddedEnv) {
-          const envKeysFilepath = localDisplayPath(localKeyAddedEnv.envKeysFilepath)
-          msg += ` + local key (${envKeysFilepath})`
-        }
         if (remoteKeyAddedEnv) {
-          msg += ' + armored key ⛨'
+          msg += ' · armored ⛨'
         }
         logger.success(msg)
       } else if (unchangedFilepaths.length > 0) {

package/src/cli/actions/get.js

@@ -6,10 +6,10 @@ const catchAndLog = require('./../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
 const Get = require('./../../lib/services/get')
-const normalizeVltOptions = require('./normalizeVltOptions')
+const normalizeArmorOptions = require('./normalizeArmorOptions')
 
 async function get (key) {
-  const options = normalizeVltOptions(this.opts())
+  const options = normalizeArmorOptions(this.opts())
   const spinner = await createSpinner({ ...options, text: 'decrypting' })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
@@ -30,8 +30,8 @@ async function get (key) {
 
   try {
     const sesh = new Session()
-    const noVlt = options.vlt === false || (await sesh.noVlt())
-    const { parsed, errors } = await new Get(key, envs, options.overload, options.all, options.envKeysFile, noVlt).run()
+    const noArmor = options.armor === false || (await sesh.noArmor())
+    const { parsed, errors } = await new Get(key, envs, options.overload, options.all, options.envKeysFile, noArmor).run()
 
     for (const error of errors || []) {
       if (options.strict) throw error // throw immediately if strict

package/src/cli/actions/keypair.js

@@ -3,10 +3,10 @@ const { logger } = require('./../../shared/logger')
 const Keypair = require('./../../lib/services/keypair')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
-const normalizeVltOptions = require('./normalizeVltOptions')
+const normalizeArmorOptions = require('./normalizeArmorOptions')
 
 async function keypair (key) {
-  const options = normalizeVltOptions(this.opts())
+  const options = normalizeArmorOptions(this.opts())
   const spinner = await createSpinner({ ...options, text: 'retrieving' })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
@@ -17,8 +17,8 @@ async function keypair (key) {
   const prettyPrint = options.prettyPrint || options.pp
 
   const sesh = new Session()
-  const noVlt = options.vlt === false || await sesh.noVlt()
-  const keypairs = await new Keypair(options.envFile, options.envKeysFile, noVlt).run()
+  const noArmor = options.armor === false || await sesh.noArmor()
+  const keypairs = await new Keypair(options.envFile, options.envKeysFile, noArmor).run()
   const results = key ? keypairs[key] : keypairs
 
   if (spinner) spinner.stop()

package/src/cli/actions/normalizeArmorOptions.js

@@ -0,0 +1,11 @@
+function normalizeArmorOptions (options) {
+  if (options.armor === false || options.ops === false || options.vlt === false) {
+    options.armor = false
+    options.ops = false
+    options.vlt = false
+  }
+
+  return options
+}
+
+module.exports = normalizeArmorOptions

package/src/cli/actions/rotate.js

@@ -5,25 +5,24 @@ const Rotate = require('./../../lib/services/rotate')
 
 const catchAndLog = require('../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
-const localDisplayPath = require('../../lib/helpers/localDisplayPath')
 const Session = require('../../db/session')
-const normalizeVltOptions = require('./normalizeVltOptions')
+const normalizeArmorOptions = require('./normalizeArmorOptions')
 
 async function rotate () {
-  const options = normalizeVltOptions(this.opts())
+  const options = normalizeArmorOptions(this.opts())
   const spinner = await createSpinner({ ...options, text: 'rotating', frames: ['⟳', '⤾', '⥁'] })
 
   logger.debug(`options: ${JSON.stringify(options)}`)
 
   const envs = this.envs
   const sesh = new Session()
-  const noVlt = options.vlt === false || (await sesh.noVlt())
+  const noArmor = options.armor === false || (await sesh.noArmor())
 
   // stdout - should not have a try so that exit codes can surface to stdout
   if (options.stdout) {
     const {
       processedEnvs
-    } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noVlt).run()
+    } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noArmor).run()
     if (spinner) spinner.stop()
     for (const processedEnv of processedEnvs) {
       console.log(processedEnv.envSrc)
@@ -39,7 +38,7 @@ async function rotate () {
         processedEnvs,
         changedFilepaths,
         unchangedFilepaths
-      } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noVlt).run()
+      } = await new Rotate(envs, options.key, options.excludeKey, options.envKeysFile, noArmor).run()
 
       for (const processedEnv of processedEnvs) {
         logger.verbose(`rotating ${processedEnv.envFilepath} (${processedEnv.filepath})`)
@@ -59,16 +58,11 @@ async function rotate () {
 
       if (spinner) spinner.stop()
       if (changedFilepaths.length > 0) {
-        const localKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.localPrivateKeyAdded)
         const remoteKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.remotePrivateKeyAdded)
 
         let msg = `⟳ rotated (${changedFilepaths.join(',')})`
-        if (localKeyAddedEnv) {
-          const envKeysFilepath = localDisplayPath(localKeyAddedEnv.envKeysFilepath)
-          msg += ` + local key (${envKeysFilepath})`
-        }
         if (remoteKeyAddedEnv) {
-          msg += ' + armored key ⛨'
+          msg += ' · armored ⛨'
         }
         logger.success(msg)
       } else if (unchangedFilepaths.length > 0) {

package/src/cli/actions/run.js

@@ -6,13 +6,13 @@ const Run = require('./../../lib/services/run')
 const catchAndLog = require('./../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
 const Session = require('../../db/session')
-const normalizeVltOptions = require('./normalizeVltOptions')
+const normalizeArmorOptions = require('./normalizeArmorOptions')
 
 const conventions = require('./../../lib/helpers/conventions')
 const { determine } = require('./../../lib/helpers/envResolution')
 
 async function run () {
-  const options = normalizeVltOptions(this.opts())
+  const options = normalizeArmorOptions(this.opts())
   const commandArgs = this.args
   const spinner = await createSpinner({ ...options, text: 'injecting' })
 
@@ -22,7 +22,7 @@ async function run () {
   const ignore = options.ignore || []
 
   const sesh = new Session()
-  const noVlt = options.vlt === false || (await sesh.noVlt())
+  const noArmor = options.armor === false || (await sesh.noArmor())
 
   if (commandArgs.length < 1) {
     if (spinner) spinner.stop()
@@ -54,11 +54,8 @@ async function run () {
       readableStrings,
       readableFilepaths,
       uniqueInjectedKeys
-    } = await new Run(envs, options.overload, process.env, options.envKeysFile, noVlt, {
+    } = await new Run(envs, options.overload, process.env, options.envKeysFile, noArmor, {
       keypairHooks: {
-        before: () => {
-          if (spinner) spinner.start('retrieving')
-        },
         after: () => {
           if (spinner) spinner.start('injecting')
         }
@@ -114,8 +111,11 @@ async function run () {
       msg += ` from --env flag${readableStrings.length > 1 ? 's' : ''}`
     }
 
+    const armoredPrivateKeyUsed = processedEnvs.some((processedEnv) => processedEnv.armoredPrivateKeyUsed)
+    const keyUsedSuffix = armoredPrivateKeyUsed ? ' · armored ⛨' : ''
+
     if (spinner) spinner.stop()
-    logger.successv(msg)
+    logger.success(`⟐ ${msg}${keyUsedSuffix}`)
   } catch (error) {
     if (spinner) spinner.stop()
     catchAndLog(error)

package/src/cli/actions/set.js

@@ -3,13 +3,12 @@ const { logger } = require('./../../shared/logger')
 
 const catchAndLog = require('../../lib/helpers/catchAndLog')
 const createSpinner = require('../../lib/helpers/createSpinner')
-const localDisplayPath = require('../../lib/helpers/localDisplayPath')
 const Session = require('../../db/session')
 const Sets = require('./../../lib/services/sets')
-const normalizeVltOptions = require('./normalizeVltOptions')
+const normalizeArmorOptions = require('./normalizeArmorOptions')
 
 async function set (key, value) {
-  const options = normalizeVltOptions(this.opts())
+  const options = normalizeArmorOptions(this.opts())
 
   let encrypt = true
   let settingMessage = 'encrypting'
@@ -28,14 +27,14 @@ async function set (key, value) {
     const sesh = new Session()
     const envs = this.envs
     const envKeysFilepath = options.envKeysFile
-    const noVlt = options.vlt === false || (await sesh.noVlt())
+    const noArmor = options.armor === false || (await sesh.noArmor())
     const noCreate = options.create === false
 
     const {
       processedEnvs,
       changedFilepaths,
       unchangedFilepaths
-    } = await new Sets(key, value, envs, encrypt, envKeysFilepath, noVlt, noCreate).run()
+    } = await new Sets(key, value, envs, encrypt, envKeysFilepath, noArmor, noCreate).run()
 
     let withEncryption = ''
 
@@ -59,11 +58,8 @@ async function set (key, value) {
     const localKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.localPrivateKeyAdded)
     const remoteKeyAddedEnv = processedEnvs.find((processedEnv) => processedEnv.remotePrivateKeyAdded)
     let keyAddedSuffix = ''
-    if (localKeyAddedEnv) {
-      keyAddedSuffix = ` + local key (${localDisplayPath(localKeyAddedEnv.envKeysFilepath)})`
-    }
     if (remoteKeyAddedEnv) {
-      keyAddedSuffix = ' + armored key ⛨'
+      keyAddedSuffix = ' · armored ⛨'
     }
 
     if (spinner) spinner.stop()
@@ -73,7 +69,7 @@ async function set (key, value) {
       } else {
         logger.success(`◇ set ${key} (${changedFilepaths.join(',')})`)
       }
-    } else if (encrypt && localKeyAddedEnv) { // TODO: this needs to take into account remoteKeyAddedEnv
+    } else if (encrypt && localKeyAddedEnv) {
       const localKeyAddedEnvFilepath = localKeyAddedEnv.envFilepath || changedFilepaths[0] || '.env'
       logger.success(`◈ encrypted ${key} (${localKeyAddedEnvFilepath})${keyAddedSuffix}`)
     } else if (unchangedFilepaths.length > 0) {

package/src/cli/commands/ext.js

@@ -65,7 +65,7 @@ ext.command('precommit')
     return require('./../actions/ext/precommit').apply(this, args)
   })
 
-// dotenvx scan
+// dotenvx ext scan
 ext.command('scan')
   .description('scan for leaked secrets')
   .action(function (...args) {